All practice questions

1591 questions

All types1,591 Multiple choice816 Multiple select491 Numeric12 Matching10 Ordering262

A cloud engineer needs to collect detailed system memory utilization metrics and application log files from a newly deployed fleet of Compute Engine virtual machine instances. Which TWO configuration steps should the engineer perform to fulfill these telemetry requirements following Google Cloud recommended practices?

Select all that apply

Install the unified Google Cloud Ops Agent on each VM instance.

Install the standalone legacy Stackdriver Logging and Monitoring agents on each VM instance.

Grant the service account attached to the VM instances the Monitoring Metric Writer and Logs Writer roles.

Grant the primitive Owner role to the Compute Engine default service account.

Show answer & explanation

Answer: Install the unified Google Cloud Ops Agent on each VM instance.; Grant the service account attached to the VM instances the Monitoring Metric Writer and Logs Writer roles.

Answer

To collect system memory metrics and log files from Compute Engine instances using Google Cloud recommended practices, you must install the unified Google Cloud Ops Agent on the VM instances and ensure the VM service account is assigned least-privilege predefined roles (Monitoring Metric Writer and Logs Writer).

The correct steps involve installing the unified Google Cloud Ops Agent on the VM instances and granting the VM service account the specific predefined IAM roles for Monitoring Metric Writer and Logs Writer. The Ops Agent gathers system-level metrics such as memory utilization and application logs, while the predefined IAM roles authorize telemetry data export securely under the principle of least privilege.

Step-by-Step Solution

Identify the recommended telemetry agent for Google Cloud Compute Engine instances.

The unified Google Cloud Ops Agent replaces legacy agents and combines metric and log collection.

Google Cloud recommends the Ops Agent for all new VM observability setups.

Determine the necessary IAM roles for exporting metrics and logs to Google Cloud Observability.

Assign the predefined roles Monitoring Metric Writer (roles/monitoring.metricWriter) and Logs Writer (roles/logging.logWriter) to the service account.

Following the principle of least privilege ensures proper write access without granting excessive administrative permissions.

Key Concept

Google Cloud Ops Agent installation and IAM permission requirements for VM telemetry.

Question 1142Question →

An automated analytics pipeline deployed on Cloud Run operates using the runtime service account [email protected]. To complete batch jobs, it must mint short-lived OAuth 2.0 access tokens to impersonate [email protected] without using static credentials. Following the principle of least privilege, which configuration enables this impersonation capability?

Assign the predefined IAM role roles/iam.serviceAccountTokenCreator on the target bq-exporter service account to principal [email protected].

Assign the predefined IAM role roles/iam.serviceAccountUser on the target bq-exporter service account to principal [email protected].

Create a long-lived service account key file in JSON format for bq-exporter and store it in Secret Manager for Cloud Run to access.

Bind the Project Editor primitive role to [email protected] across the target project resource hierarchy.

Show answer & explanation

Answer: Assign the predefined IAM role roles/iam.serviceAccountTokenCreator on the target bq-exporter service account to principal [email protected].

Answer

Assign the predefined IAM role roles/iam.serviceAccountTokenCreator on the target bq-exporter service account to principal [email protected].

To impersonate a target service account and generate short-lived tokens keylessly, the principal making the call must be granted the roles/iam.serviceAccountTokenCreator role directly on that target service account.

Step-by-Step Solution

Identify the source principal and target resource

The source principal is [email protected] and the target resource being impersonated is [email protected].

Impersonation requires configuring IAM policy bindings directly on the target service account.

Determine the required permission capability

The requirement specifies generating short-lived access tokens without long-lived keys.

Minting short-lived tokens requires the iam.serviceAccounts.getAccessToken permission contained in the Service Account Token Creator role.

Select the minimum necessary IAM role binding

Assigning roles/iam.serviceAccountTokenCreator on the target service account grants the exact permission needed for impersonation without granting overprivileged project access.

This satisfies GCP security best practices and the principle of least privilege.

Key Concept

Service Account Impersonation via Service Account Token Creator Role

Estimated Time:1m 30s

Question 1143Question →

A cloud administrator manages a Compute Engine virtual machine running a stateful database application on a standard persistent disk (`pd-standard`). Due to increasing transaction volume, the database is experiencing disk I/O bottlenecks. The administrator needs to increase both disk IOPS and throughput with minimal operational impact and without recreating the VM or detaching the disk. Which action should the administrator take to achieve this requirement following Google Cloud best practices?

Increase the size of the existing persistent disk while it remains attached to the VM, and then expand the file system within the guest operating system.

Reconfigure the VM instance provisioning model to Spot VM to automatically unlock higher baseline IOPS tiers for standard persistent disks.

Submit a quota increase request for Compute Engine Disk IOPS in the IAM & Admin Console prior to expanding disk capacity.

Grant the primitive Owner role to the VM instance service account to allow dynamic hypervisor IOPS allocation.

Show answer & explanation

Answer: Increase the size of the existing persistent disk while it remains attached to the VM, and then expand the file system within the guest operating system.

Answer

Increase the size of the existing persistent disk while attached to the running VM, and then expand the file system from within the guest operating system.

In Compute Engine, persistent disk performance (IOPS and throughput) scales linearly with the size of the disk. Disks can be expanded online without detaching them or stopping the virtual machine. Once the disk capacity is increased via the Cloud Console or gcloud CLI, the administrator only needs to resize the file system within the guest OS to gain the additional capacity and higher I/O performance limits.

Step-by-Step Solution

Identify the storage performance scaling mechanism in Compute Engine.

Recognize that persistent disk performance (IOPS and throughput) increases linearly with provisioned disk size up to specified per-disk limits.

Standard persistent disks scale performance based on disk capacity rather than API settings or IAM configurations.

Resize the persistent disk using Google Cloud tools (Cloud Console or `gcloud compute disks resize`).

The disk capacity and corresponding IOPS/throughput limits are expanded immediately while the disk remains attached to the running VM.

Compute Engine supports online persistent disk expansion without requiring instance shutdown or disk detachment.

Resize the partition and file system inside the guest OS.

The operating system detects and utilizes the additional disk space and improved I/O limits.

Increasing the GCP disk size makes raw storage available, but file system utilities (such as `resize2fs` or `xfs_growfs`) are necessary to make the extra space usable by applications.

Key Concept

Online Persistent Disk Resizing and Performance Scaling

Estimated Time:2m 0s

Question 1144Question →

A DevOps engineer needs to configure GKE Workload Identity so that an application running in a Kubernetes cluster can securely access Google Cloud resources without using exported service account key files. Which TWO of the following configuration actions must be performed to complete this setup?

Select all that apply

Grant the roles/iam.workloadIdentityUser role on the Google Service Account to the Kubernetes Service Account member.

Download the service account private key file in JSON format and mount it inside the container pod.

Annotate the Kubernetes Service Account with the email address of the Google Service Account.

Assign the primitive Owner role (roles/owner) to the Kubernetes Service Account at the organization level.

Show answer & explanation

Answer: Grant the roles/iam.workloadIdentityUser role on the Google Service Account to the Kubernetes Service Account member.; Annotate the Kubernetes Service Account with the email address of the Google Service Account.

Answer

The two required configuration actions are binding the IAM Workload Identity User role to the Kubernetes Service Account on the Google Service Account, and annotating the Kubernetes Service Account with the Google Service Account email address.

To set up GKE Workload Identity, you must authorize the Kubernetes Service Account (KSA) to impersonate the Google Service Account (GSA) by assigning the roles/iam.workloadIdentityUser role, and you must annotate the KSA with the GSA's email address so GKE pods receive short-lived credentials.

Step-by-Step Solution

Bind the IAM Workload Identity User role

The Kubernetes Service Account is allowed to impersonate the Google Service Account.

The roles/iam.workloadIdentityUser permission establishes trust between the Kubernetes identity and Google Cloud IAM.

Annotate the Kubernetes Service Account

GKE metadata server automatically provides short-lived tokens for the specified Google Service Account to pods using this Kubernetes Service Account.

The annotation identifies which target Google Service Account identity the Kubernetes pod should adopt.

Key Concept

Configuring Workload Identity between Kubernetes Service Accounts and Google Service Accounts

Question 1145Question →

An enterprise cloud team is creating reusable Google Cloud Deployment Manager templates (`storage_bucket.jinja`) to standardize Cloud Storage bucket deployments across multiple projects. The team wants to enforce parameter validation—such as requiring the `storage_class` input parameter and verifying allowed string values—so that invalid configuration files fail prior to resource creation. Which approach correctly implements this pre-deployment parameter validation in Deployment Manager?

Create a companion schema file named `storage_bucket.jinja.schema` that defines mandatory properties and allowed values using JSON Schema.

Append the `--validate-schema` flag to the `gcloud deployment-manager deployments create` command during deployment execution.

Set `enforce_uniform_bucket_level_access = true` inside the properties block of the top-level YAML configuration file.

Enable the Cloud Resource Manager API in the parent Google Cloud Organization resource node.

Show answer & explanation

Answer: Create a companion schema file named `storage_bucket.jinja.schema` that defines mandatory properties and allowed values using JSON Schema.

Answer

Create a companion schema file named `storage_bucket.jinja.schema` that defines mandatory properties and allowed values using JSON Schema.

In Google Cloud Deployment Manager, schema files (`.schema`) written in JSON Schema format allow authors to define rules for template properties. By creating `storage_bucket.jinja.schema`, Deployment Manager validates that required fields (such as `storage_class`) are present and conform to specified constraints before applying the deployment.

Step-by-Step Solution

Identify the Deployment Manager requirement for template parameter validation.

Deployment Manager allows developers to define input rules for Jinja2 or Python templates.

Validation ensures invalid inputs are caught before API calls are made.

Match the requirement to the standard Deployment Manager schema contract.

A `.schema` file written in JSON Schema format matching the template name enforces required fields, types, and allowed values.

Deployment Manager automatically loads and checks `.schema` files alongside template imports.

Key Concept

Deployment Manager Schema Validation

Question 1146Question →

An enterprise security policy requires granting an external analytics team read access to messages processed by a Google Cloud Pub/Sub subscription and read-only access to log archive files in a specific Cloud Storage bucket within the `iot-telemetry-prod` project. The team must not be permitted to publish messages, alter Pub/Sub configurations, or modify/delete storage buckets and objects. Which TWO of the following IAM role configurations follow the principle of least privilege while providing the required access? (Select TWO.)

Select all that apply

Grant `roles/pubsub.subscriber` on the specific Pub/Sub subscription in the `iot-telemetry-prod` project.

Grant the primitive `roles/editor` role at the `iot-telemetry-prod` project level.

Grant `roles/storage.objectViewer` directly on the target Cloud Storage bucket resource.

Grant `roles/storage.admin` at the parent Folder level containing the `iot-telemetry-prod` project.

Show answer & explanation

Answer: Grant `roles/pubsub.subscriber` on the specific Pub/Sub subscription in the `iot-telemetry-prod` project.; Grant `roles/storage.objectViewer` directly on the target Cloud Storage bucket resource.

Answer

Granting `roles/pubsub.subscriber` on the Pub/Sub subscription and granting `roles/storage.objectViewer` on the specific Cloud Storage bucket.

The Pub/Sub Subscriber role (`roles/pubsub.subscriber`) provides the minimal permissions necessary to read messages from Pub/Sub subscriptions without granting permissions to modify topics or publish data. Similarly, granting Storage Object Viewer (`roles/storage.objectViewer`) directly on the specific Cloud Storage bucket allows reading object data while preventing object deletion, bucket deletion, or broader project-level changes.

Step-by-Step Solution

Analyze required Pub/Sub permissions against the principle of least privilege.

The team only needs to consume subscription messages. The predefined role `roles/pubsub.subscriber` grants subscription consumption rights without allowing topic publishing or management.

Choosing fine-grained predefined roles over primitive roles prevents over-privileging identities.

Analyze required Cloud Storage permissions and target scope.

The predefined role `roles/storage.objectViewer` scoped directly to the target bucket permits listing and reading objects without granting deletion or bucket modification rights.

Applying bindings at the resource level avoids granting unintended access across all buckets in the project or folder.

Evaluate and eliminate incorrect distractor options.

Assigning primitive Editor access grants broad write permissions project-wide, while folder-level Storage Admin access propagates full administrative rights to all child projects via resource hierarchy inheritance.

Both distractor options violate the principle of least privilege through over-scopings and role severity.

Key Concept

Applying Predefined IAM Roles at Resource-Specific Scopes for Least Privilege

Question 1147Question →

A system engineer needs to provision a production Cloud SQL for MySQL instance named 'prod-mysql-db' in the us-central1 region. Organizational security policies mandate that the database instance must connect exclusively via Private IP within the custom Virtual Private Cloud (VPC) network named 'prod-vpc' and must not have an external public IP address assigned. Which gcloud command correctly provisions the Cloud SQL instance to meet these security requirements?

gcloud sql instances create prod-mysql-db --database-version=MYSQL_8_0 --cpu=4 --memory=16GiB --network=projects/my-project/global/networks/prod-vpc --no-assign-ip --region=us-central1

gcloud sql instances create prod-mysql-db --database-version=MYSQL_8_0 --cpu=4 --memory=16GiB --authorized-networks=prod-vpc --region=us-central1

gcloud sql instances create prod-mysql-db --database-version=MYSQL_8_0 --cpu=4 --memory=16GiB --enable-private-ip --vpc-name=prod-vpc --region=us-central1

gcloud sql instances create prod-mysql-db --database-version=MYSQL_8_0 --cpu=4 --memory=16GiB --network=prod-vpc --assign-ip --region=us-central1

Show answer & explanation

Answer: gcloud sql instances create prod-mysql-db --database-version=MYSQL_8_0 --cpu=4 --memory=16GiB --network=projects/my-project/global/networks/prod-vpc --no-assign-ip --region=us-central1

Answer

The command specifying '--network=projects/my-project/global/networks/prod-vpc' alongside '--no-assign-ip' correctly provisions the Cloud SQL instance with Private IP connectivity while suppressing public IP address assignment.

Provisioning a Cloud SQL instance with exclusive Private IP access requires attaching it to the target VPC network using the `--network` parameter and disabling public IP address allocation using `--no-assign-ip`.

Step-by-Step Solution

Identify network connectivity requirement

The database must use Private IP connectivity within the custom VPC 'prod-vpc'.

Connecting Cloud SQL to a internal VPC requires configuring Private Services Access and specifying the --network flag in gcloud.

Identify public access restriction

The instance must not receive a public IPv4 address.

By default Cloud SQL instances receive a public IP unless the --no-assign-ip flag is explicitly provided during creation.

Select the correct gcloud syntax

Combine --network and --no-assign-ip in the gcloud sql instances create command.

This combination provisions private IP routing over VPC peering while blocking public IP interface assignment.

Key Concept

Cloud SQL Private IP Instance Provisioning

Estimated Time:1m 30s

Question 1148Question →

A developer requests a service account JSON key file to authenticate an application running on a Compute Engine virtual machine instance to BigQuery. Following Google Cloud security best practices, which approach should you take to provide authentication for the application?

Attach a custom service account with the necessary predefined BigQuery roles directly to the Compute Engine instance.

Generate a new service account JSON key file and upload it to the Compute Engine instance's local file system.

Grant the primitive Owner role to the Compute Engine default service account and store its default key in the application configuration.

Enable the BigQuery API at the organization level and download the organization root service account credentials.

Show answer & explanation

Answer: Attach a custom service account with the necessary predefined BigQuery roles directly to the Compute Engine instance.

Answer

Attach a custom service account with the necessary predefined BigQuery roles directly to the Compute Engine instance.

Attaching a custom service account directly to a Compute Engine instance allows applications to retrieve access tokens automatically via the internal metadata server. This eliminates the need to generate, store, or rotate service account JSON keys, adhering strictly to Google Cloud security best practices.

Step-by-Step Solution

Identify the environment and workload context

The application runs internally on a Compute Engine virtual machine instance within Google Cloud.

Internal GCP workloads do not require exported security keys for authentication.

Apply Google Cloud IAM best practices for service account management

Use instance metadata authentication by assigning a custom service account with least-privilege predefined roles.

Attached service accounts leverage automatically managed short-lived tokens, eliminating the maintenance and leak risk of long-lived service account JSON keys.

Key Concept

Service Account Attachment vs. Key File Export

Question 1149Question →

A cluster administrator needs to perform a manual control plane and worker node version upgrade on a Google Kubernetes Engine (GKE) Standard cluster named `prod-analytics-cluster` located in region `us-central1`. Automatic node upgrades are disabled for this cluster due to customized maintenance windows. What is the correct sequence of operational steps to upgrade the control plane first, verify stability, and then safely upgrade the node pool?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins by checking available cluster versions with `gcloud container get-server-config`, upgrading the control plane master using `gcloud container clusters upgrade` with the `--master-only` flag, verifying control plane health, upgrading the node pool using `gcloud container node-pools upgrade`, and finally verifying node readiness using `kubectl get nodes`.

The correct order follows GCP best practices for manual GKE cluster maintenance: first query valid versions (`gcloud container get-server-config`), then upgrade the control plane (`gcloud container clusters upgrade --master-only`), confirm control plane health, upgrade worker node pools (`gcloud container node-pools upgrade`), and verify node health with `kubectl get nodes`.

Step-by-Step Solution

Query available GKE server versions

Identified valid target Kubernetes versions supported in `us-central1`

Before triggering upgrades, valid target versions must be verified against regional GKE availability.

Initiate control plane upgrade

Control plane upgraded using `--master-only`

Kubernetes version compatibility rules mandate that GKE control planes must be upgraded before worker node pools.

Verify control plane status

Control plane state confirmed as `RUNNING`

Ensures API server availability and control plane health before starting rolling updates on worker nodes.

Upgrade worker node pool

Node pool upgraded to target version using `gcloud container node-pools upgrade`

Node pools are upgraded after the master control plane is stable.

Validate cluster node health

All nodes return `Ready` status on the updated version via `kubectl get nodes`

Final validation ensures all workloads transitioned cleanly and all nodes operate correctly on the new release.

Key Concept

GKE Cluster and Node Pool Manual Upgrade Order

Question 1150Question →

A cloud engineer manages a production Cloud Run service named `checkout-api` deployed in the `europe-west1` region. A new revision named `checkout-api-v2` was previously deployed with the `--no-traffic` flag for testing. After successful verification, the engineer must immediately adjust the live traffic allocation so that $25\%$ of incoming requests are routed to `checkout-api-v2` while the remaining $75\%$ continues to serve on the existing revision `checkout-api-v1`. Which `gcloud` command should the engineer run to accomplish this traffic split?

gcloud run services update-traffic checkout-api --region=europe-west1 --to-revisions=checkout-api-v1=75,checkout-api-v2=25

gcloud run deploy checkout-api --region=europe-west1 --image=gcr.io/my-project/checkout-api:v2 --traffic=checkout-api-v1=75,checkout-api-v2=25

gcloud functions deploy checkout-api --region=europe-west1 --update-traffic=checkout-api-v1=75,checkout-api-v2=25

gcloud run services update-traffic checkout-api --region=europe-west1 --to-latest

Show answer & explanation

Answer: gcloud run services update-traffic checkout-api --region=europe-west1 --to-revisions=checkout-api-v1=75,checkout-api-v2=25

Answer

The command `gcloud run services update-traffic checkout-api --region=europe-west1 --to-revisions=checkout-api-v1=75,checkout-api-v2=25` correctly splits traffic between existing Cloud Run revisions.

To modify traffic distribution across existing Cloud Run revisions without creating a new revision, you must use the `gcloud run services update-traffic` command. Specifying `--to-revisions=checkout-api-v1=75,checkout-api-v2=25` explicitly routes

75\%

of incoming requests to the baseline revision and

25\%

to the test revision.

Step-by-Step Solution

Identify the operational goal for managing existing Cloud Run revisions

Recognize that traffic needs to be split across existing revisions (`checkout-api-v1` and `checkout-api-v2`) without creating a new revision.

Deploying a new container container image is unnecessary since `checkout-api-v2` is already deployed.

Select the correct gcloud CLI subcommand for Cloud Run traffic management

Use `gcloud run services update-traffic` rather than `gcloud run deploy` or `gcloud functions deploy`.

The `update-traffic` command specifically manages traffic assignments across active revisions of a service.

Configure revision target flags and percentages

Pass `--to-revisions=checkout-api-v1=75,checkout-api-v2=25` along with the `--region=europe-west1` flag.

The `--to-revisions` flag maps explicit revision names to their respective integer traffic percentages.

Key Concept

Managing Cloud Run revision traffic allocation via gcloud run services update-traffic

Estimated Time:2m 0s

Question 1151Question →

A DevOps engineer needs to deploy a new revision of an existing containerized API service to Google Cloud Run. To satisfy testing requirements, the new revision must be deployed without receiving any production user traffic until internal verification is complete. Which command should the engineer execute to deploy the container image while preserving 100% of live traffic on the current revision?

gcloud run deploy api-service --image=gcr.io/my-project/api:v2 --no-traffic

gcloud run deploy api-service --image=gcr.io/my-project/api:v2 --traffic=0

gcloud run deploy api-service --image=gcr.io/my-project/api:v2 --min-instances=0

gcloud functions deploy api-service --image=gcr.io/my-project/api:v2 --no-traffic

Show answer & explanation

Answer: gcloud run deploy api-service --image=gcr.io/my-project/api:v2 --no-traffic

Answer

The command containing `gcloud run deploy api-service --image=gcr.io/my-project/api:v2 --no-traffic` correctly deploys the container revision without directing traffic to it.

Executing `gcloud run deploy` with the `--no-traffic` flag creates the new service revision in Google Cloud Run while retaining 100% of live production traffic on the previously serving revision. This allows developers to safely verify and test the new revision via revision-specific URLs or tags before updating the service traffic split.

Step-by-Step Solution

Identify the target serverless compute product

The requirement specifies an existing containerized service deployed to Cloud Run, requiring `gcloud run deploy`.

Cloud Run handles container deployment and service management, whereas Cloud Functions targets function code runtimes.

Determine default revision traffic routing behavior in Cloud Run

By default, `gcloud run deploy` routes 100% of traffic to the newly created revision immediately.

Overriding default traffic assignment requires an explicit flag during deployment.

Select the correct `gcloud run deploy` flag to suppress traffic allocation

Using `--no-traffic` ensures the revision is created, but receives 0% of traffic, leaving existing traffic splits unchanged.

The `--no-traffic` flag is the built-in mechanism for creating revisions without shifting live production traffic.

Key Concept

Cloud Run Traffic Management during Revision Deployment

Estimated Time:1m 30s

Question 1152Question →

A company is planning the storage architecture for a self-managed relational database running on a Compute Engine virtual machine. The database workload requires SSD-level performance and lower latency than standard magnetic persistent disks, but the cloud engineering team wants a cost-effective option compared to high-performance SSD persistent disks (`pd-ssd`). The storage must persist independently of the VM instance lifecycle and provide standard zonal redundancy. Which storage option should the team select?

Balanced persistent disk (`pd-balanced`)

Local SSD attached to a Spot Compute Engine VM instance

Cloud Bigtable provisioned with a SSD storage cluster

Cloud Storage Coldline bucket mounted using Cloud Storage FUSE

Show answer & explanation

Answer: Balanced persistent disk (`pd-balanced`)

Answer

Balanced persistent disk (`pd-balanced`) is the recommended storage type because it offers SSD-backed performance at a lower cost point than `pd-ssd`, while maintaining persistent zonal durability independent of VM instance lifecycle.

Balanced persistent disk (`pd-balanced`) is specifically designed to bridge the gap between standard magnetic persistent disks (`pd-standard`) and high-performance SSD disks (`pd-ssd`). It provides SSD performance suitable for standard relational databases at a lower price point while ensuring data persistence independent of the Compute Engine VM lifecycle.

Step-by-Step Solution

Analyze workload storage requirements

Identified the need for persistent, durable block storage suitable for a relational database with SSD performance, lower cost than `pd-ssd`, and independence from VM lifecycle.

Relational database engines require reliable block storage with consistent IOPS and data persistence across VM restarts.

Evaluate Google Cloud block storage and database options

Balanced persistent disks (`pd-balanced`) deliver a baseline of SSD performance tailored for standard database workloads at a lower price per gigabyte compared to `pd-ssd`.

Local SSDs are non-persistent/ephemeral, Cloud Bigtable is a NoSQL engine unsuited for relational databases, and Coldline object storage incurs severe latency and retrieval charges when used as active file storage.

Key Concept

Selecting persistent disk types based on database performance, durability, and cost constraints.

Estimated Time:1m 30s

Question 1153Question →

A Cloud Engineer needs to allow a developer to execute gcloud CLI commands by short-lived impersonation of a dedicated deployment service account, without creating or downloading service account keys. Which IAM role should be assigned to the developer on the target service account?

Service Account Token Creator (roles/iam.serviceAccountTokenCreator)

Service Account Key Admin (roles/iam.serviceAccountKeyAdmin)

Editor (roles/editor)

Security Admin (roles/iam.securityAdmin)

Show answer & explanation

Answer: Service Account Token Creator (roles/iam.serviceAccountTokenCreator)

Answer

The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) should be assigned to the developer on the target service account.

The Service Account Token Creator role provides the exact permissions required to mint short-lived tokens and impersonate a Google Cloud service account without creating service account keys.

Step-by-Step Solution

Identify the goal of keyless service account delegation.

The developer needs short-lived credential access via impersonation without generating persistent JSON private keys.

Impersonation eliminates key management overhead and security risks associated with long-lived key files.

Determine the predefined IAM role specific to token minting.

Select the Service Account Token Creator role.

This role includes the iam.serviceAccounts.getAccessToken permission needed to generate impersonation tokens for gcloud commands.

Key Concept

Service Account Impersonation Roles

Estimated Time:1m 0s

Question 1154Question →

A company requires an external compliance officer to audit security configurations in a Google Cloud project named `finance-analytics-prod`. The auditor needs to inspect IAM policy bindings across the project and view metadata configurations for Cloud Spanner instances and databases. The auditor must NOT be able to read sensitive records stored inside the Spanner database tables or alter any GCP resources. Which TWO IAM role assignments should you configure for the auditor at the project level to satisfy these requirements while adhering to the principle of least privilege?

Select all that apply

Grant the Security Reviewer role (`roles/iam.securityReviewer`) on the project.

Grant the Cloud Spanner Viewer role (`roles/spanner.viewer`) on the project.

Grant the primitive Viewer role (`roles/viewer`) on the project.

Grant the Security Reviewer role (`roles/iam.securityReviewer`) at the parent Organization level.

Show answer & explanation

Answer: Grant the Security Reviewer role (`roles/iam.securityReviewer`) on the project.; Grant the Cloud Spanner Viewer role (`roles/spanner.viewer`) on the project.

Answer

Assign the Security Reviewer role (`roles/iam.securityReviewer`) and the Cloud Spanner Viewer role (`roles/spanner.viewer`) at the project level.

To grant read-only security audit capabilities and Spanner metadata visibility under the principle of least privilege, predefined roles should be bound at the target project scope. The Security Reviewer role (`roles/iam.securityReviewer`) allows security configuration and IAM policy inspection, while the Cloud Spanner Viewer role (`roles/spanner.viewer`) grants metadata read access without permitting data row retrieval.

Step-by-Step Solution

Analyze the IAM requirements for auditing security policies.

Identify that inspect-only access for IAM bindings across project resources requires `roles/iam.securityReviewer`.

Security Reviewer grants security-related read permissions without providing access to actual underlying data stored in resources.

Analyze the IAM requirements for viewing Cloud Spanner instance and database metadata.

Identify that viewing database structure/metadata without reading table rows requires `roles/spanner.viewer`.

Cloud Spanner Viewer allows inspecting instance, database, and schema metadata while denying data plane read permissions (`spanner.databases.read`).

Verify scope and principle of least privilege.

Apply both predefined roles specifically at the project resource level (`finance-analytics-prod`).

Assigning predefined roles at the specific project scope avoids over-granting access via primitive roles or higher resource hierarchy levels.

Key Concept

Applying Predefined Roles at the Project Level for Least-Privilege IAM Audit Access

Question 1155Question →

A Cloud Engineer needs to deploy a custom microservice from local source code to Google Cloud Run and secure it so that only a specific client service account can invoke it. Arrange the steps in the correct sequential order from initial image creation to post-deployment verification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1. Build and push the container image to Artifact Registry using gcloud builds submit. 2. Deploy the container image to Cloud Run with unauthenticated access disabled. 3. Bind the Cloud Run Invoker role (roles/run.invoker) to the client service account. 4. Verify access by invoking the service endpoint with an identity token.

Deployment workflow follows a strict chronological order: First, the container image must be built from source code and pushed to Artifact Registry so that Cloud Run can access the container bits. Second, the Cloud Run service is created from this container image with unauthenticated invocations disabled. Third, once the service resource exists, an IAM policy binding is attached to grant the specific client service account the `roles/run.invoker` role. Fourth, the deployment is validated by sending an authenticated request using an identity token.

Step-by-Step Solution

Package and register the deployment artifact

A container image stored in Artifact Registry

Cloud Run requires a pre-built container image in a reachable container registry before deployment can commence.

Instantiate the Cloud Run service resource

A running, private Cloud Run service with a designated HTTPS URL

Deploying the service creates the target resource needed to attach service-specific IAM access policies.

Apply IAM invoker permissions

The client service account is explicitly authorized to invoke the endpoint

Adding the `roles/run.invoker` role via `gcloud run services add-iam-policy-binding` restricts invocation to the authorized identity.

Perform end-to-end verification

HTTP 200 OK response from the Cloud Run service endpoint

Sending an HTTP request with an identity token generated for the authorized service account confirms that authentication and authorization function properly.

Key Concept

Deploying containerized microservices to Cloud Run and managing service-level IAM authentication and invoker roles.

Question 1156Question →

An organization uses an automated CI/CD build pipeline running inside a central management project (`ci-build-proj`). The build process executes under a dedicated service account `[email protected]`. During the deployment phase, this pipeline must provision resources in a production project (`prod-scope-proj`) using a production service account `[email protected]`. Corporate security policies mandate that no service account keys can be exported or stored. Which IAM configuration correctly enables `ci-runner` to generate short-lived credentials to act as `prod-deployer` while strictly following the principle of least privilege?

Grant `[email protected]` the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the `[email protected]` service account resource.

Generate a service account JSON key for `[email protected]` and store it securely in the build system's secret storage.

Grant `[email protected]` the Service Account User role (`roles/iam.serviceAccountUser`) and Project Editor role (`roles/editor`) at the `prod-scope-proj` project level.

Grant `[email protected]` the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the `[email protected]` service account resource.

Show answer & explanation

Answer: Grant `[email protected]` the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the `[email protected]` service account resource.

Answer

Grant `[email protected]` the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the `[email protected]` service account resource.

To enable short-lived credentials and service account impersonation without key exports, the executing principal (the build runner service account) must be granted the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the target service account's IAM resource policy.

Step-by-Step Solution

Identify the source identity attempting impersonation and the target identity being impersonated.

Source identity: `[email protected]`. Target identity: `[email protected]`.

IAM role bindings for impersonation must be placed on the target service account resource granting access to the source principal.

Determine the required predefined IAM role for generating short-lived OAuth tokens.

The `roles/iam.serviceAccountTokenCreator` (Service Account Token Creator) role provides the required permissions to mint short-lived credentials.

`roles/iam.serviceAccountUser` only allows attaching a service account to a GCP workload, whereas creating tokens to act as the service account requires `roles/iam.serviceAccountTokenCreator`.

Apply the principle of least privilege by scoping the binding to the target service account resource.

The IAM policy binding is applied directly to `[email protected]` rather than at the project level.

Scoping access to the specific service account resource prevents granting unnecessary permissions over other service accounts in the project.

Key Concept

Service Account Impersonation via Service Account Token Creator

Question 1157Question →

A cloud engineer needs to deploy a Cloud SQL PostgreSQL instance named 'prod-db' in a custom Virtual Private Cloud (VPC) named 'app-vpc'. Security policies require that the database is accessible strictly using a Private IP address without any public IP assigned. What is the correct sequence of steps required to set up Private Services Access and provision the instance?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps is: 1) Reserve an internal IP range in the VPC using the VPC_PEERING purpose flag, 2) Establish a private connection to Google services via service peering, 3) Provision the Cloud SQL instance specifying the VPC network and disabling public IP assignment, and 4) Connect from an internal VM within the VPC to initialize database schemas.

To deploy a Cloud SQL instance with Private IP, Google Cloud requires setting up Private Services Access first. This involves reserving an internal IP address block in the VPC network (using purpose=VPC_PEERING), creating a VPC peering connection to the service producer network using gcloud services peered-connections create, provisioning the database instance with the --network and --no-assign-ip flags, and finally accessing the database from internal compute instances within the same VPC.

Step-by-Step Solution

Allocate an IP range for VPC peering.

A dedicated IP range is reserved for Private Services Access in 'app-vpc'.

Google Cloud requires an allocated IP range before a VPC peering connection can be configured for managed services.

Create the private services connection.

Peering is established between 'app-vpc' and Google's service producer VPC network.

Cloud SQL Private IP relies on VPC Network Peering established through the Service Networking API.

Create the Cloud SQL instance with private IP only.

The Cloud SQL instance is provisioned into the peered service network with an IP from the allocated range.

The --network flag binds the instance to the VPC, while --no-assign-ip prevents public IP exposure.

Access and configure the database from an internal compute resource.

Database schemas and users are configured securely over private IP connectivity.

Post-provisioning configuration can only occur once the database instance is fully deployed and accessible on the VPC.

Key Concept

Configuring Private IP Connectivity for Cloud SQL using Private Services Access

Question 1158Question →

A cloud engineer needs to gather operating system memory (RAM) utilization metrics from a Compute Engine virtual machine instance. Which agent recommended by Google Cloud should be installed on the virtual machine instance to collect these telemetry metrics?

The Google Cloud Ops Agent

The legacy Stackdriver Logging Agent

The Cloud Logging API directly at the Organization level

The Primitive Owner role on the VM default service account

Show answer & explanation

Answer: The Google Cloud Ops Agent

Answer

The Google Cloud Ops Agent is the recommended agent to collect memory utilization and system telemetry from Compute Engine virtual machines.

The Google Cloud Ops Agent is Google Cloud's primary unified agent for capturing system metrics (such as RAM and disk usage) and application logs directly from Compute Engine virtual machines.

Step-by-Step Solution

Identify the telemetry requirement

System memory metrics require guest OS level access on a Compute Engine VM.

Hypervisors cannot inspect guest OS memory details without an agent installed inside the VM.

Select the appropriate software agent

Choose the Google Cloud Ops Agent.

The Google Cloud Ops Agent combines logging and metric collection into a single, unified agent for Compute Engine.

Key Concept

Google Cloud Ops Agent Telemetry Collection

Question 1159Question →

A Cloud Engineer must configure system telemetry for a fleet of Compute Engine virtual machines (VMs) to ingest custom application logs and capture system-level metrics, such as RAM/memory utilization, which are not collected by default compute hypervisor metrics. The implementation must follow Google Cloud security best practices regarding agent selection and least-privilege access control for telemetry collection. Which TWO actions should the Cloud Engineer perform?

Select all that apply

Install and configure the unified Google Cloud Ops Agent on each Compute Engine VM instance.

Grant the service account attached to the VM instances the predefined Monitoring Metric Writer (`roles/monitoring.metricWriter`) and Logs Writer (`roles/logging.logWriter`) IAM roles.

Install the legacy Stackdriver Monitoring Agent and Stackdriver Logging Agent as separate daemon packages on each Compute Engine instance.

Grant the service account attached to the VM instances the primitive Editor (`roles/editor`) role at the Google Cloud project level.

Show answer & explanation

Answer: Install and configure the unified Google Cloud Ops Agent on each Compute Engine VM instance.; Grant the service account attached to the VM instances the predefined Monitoring Metric Writer (`roles/monitoring.metricWriter`) and Logs Writer (`roles/logging.logWriter`) IAM roles.

Answer

The correct actions are installing the unified Google Cloud Ops Agent on each VM instance and granting the VM's service account the predefined Monitoring Metric Writer and Logs Writer IAM roles.

To collect extended VM metrics (like RAM/memory utilization) and application logs, the unified Google Cloud Ops Agent must be installed on the instances. To permit telemetry submission under least privilege, the attached service account requires the predefined `roles/monitoring.metricWriter` and `roles/logging.logWriter` roles.

Step-by-Step Solution

Identify the recommended GCP telemetry collection agent for Compute Engine VMs.

Selected the unified Google Cloud Ops Agent, which handles both logging and extended system metrics like memory usage.

Legacy Stackdriver Monitoring and Logging agents are deprecated and should not be deployed for new operations.

Determine the necessary IAM roles for publishing telemetry to Cloud Operations suite.

Assigned `roles/monitoring.metricWriter` and `roles/logging.logWriter` to the service account.

Predefined roles strictly enforce least-privilege access control compared to broad primitive roles like Editor or Owner.

Key Concept

Unified Ops Agent deployment and least-privilege telemetry IAM role assignment

Question 1160Question →

A cloud administrator needs to monitor system memory (RAM) usage and disk space utilization on a fleet of Compute Engine virtual machines (VMs). By default, these OS-level metrics are not visible in Cloud Monitoring. Which agent should be installed on the virtual machines to collect these telemetry metrics?

The unified Google Cloud Ops Agent

The deprecated legacy Stackdriver Monitoring agent

Enable the Cloud Monitoring API only on the host project without installing software on the VM

Grant the Compute Engine default service account the Owner primitive role

Show answer & explanation

Answer: The unified Google Cloud Ops Agent

Answer

The unified Google Cloud Ops Agent should be installed on the Compute Engine virtual machines.

The unified Google Cloud Ops Agent is the official agent designed to collect guest OS metrics (like RAM and disk space usage) as well as logs from Compute Engine virtual machines.

Step-by-Step Solution

Identify the required telemetry data type.

The requirement calls for guest operating system metrics (memory and disk usage) from Compute Engine VMs.

Hypervisor-level monitoring only captures CPU and network metrics by default; memory metrics require in-guest telemetry gathering.

Select the current Google Cloud recommended solution for guest telemetry.

The Ops Agent combines system metric collection and log ingestion into a single daemon.

Google Cloud recommends the Ops Agent as the modern standard over older legacy agents.

Key Concept

Compute Engine OS Telemetry Collection via Google Cloud Ops Agent

PreviousPage 58 / 80Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept